Allow user to review attached .devassistant file when cloning with prep/custom

[tradej]

Simply executing an attached assistant could be a security risk. I think the user should be required to explicitly affirm their willingness to execute the .devassistant script attached to the upstream project before the actual execution, possibly with the option to review the sources. Alternatively, we could perform some sanity checks.